I am ingesting data from the Splunk Add on for O365. I want to use the Eval Expression filter within an ingestion action to filter what email addresses we ingest data from. Sampling the data is easy but the next bit isn't. I drop events where the RecipientAddress is not splunk.test@test.co.uk. Creating an | eval within a search is simple but creating something that works for a filter using eval expression,  which drops Events is where i am struggling. Our Exchange/Entra team are having problems limiting the online mailboxes the Splunk application which is why I am looking at this workaround. Ignore the application thats tagged as we are using Enterprise 9.3.4. Can you help? ... View more

Hi there, I have a dashboard and I want to subtract the total number of events of 2 queries but not sure how to do it, can you help? Query 1:   index=mssql sourcetype=SQL_Query source=Sales_Contracts_Activations* OR source=Sales_Contracts_Activations_BOM     Query 2:   index=mssql sourcetype=SQL_Query source=Esigns CALLBACK_STATUS="SUCCESS" STATUS=Complete   ... View more

I've created fields from regex expressions before but never from the source field. This is an example of the value within the source field:  \\host0000\Test\IT Information\ Data Files\Daily Reporting\Business Unit\  I would like to extract the business unit value and call it Business Unit. I have access to create a props.conf file.   Can you help?   Kind regards, Vishal ... View more

Hi all, I am getting data in via an API (using the add on builder) but having  creating a regex which splits it into a better format rather than 1 big event. Here is an example of the event:     "@odata.context": "https://example-app-env.aa01.aaa.aaaa-ad/odata/$metadata#Jobs", "@odata.count": 111, "value": [ { "Key": "aaa1a111-aa11-11aa-a11a-11a1aa11a111", "StartTime": "2023-01-20T14:08:34.607Z", "EndTime": "2023-01-20T14:08:49.517Z", "State": "Successful", "JobPriority": "Normal", "Source": "Agent", "SourceType": "Agent", "BatchExecutionKey": "aaa1a111-aa11-11aa-a11a-11a1aa11a111", "Info": "Job completed", "CreationTime": "2023-01-20T14:08:34.607Z", "StartingScheduleId": null, "ReleaseName": "RobotProdLogin_DEV", "Type": "Attended", "InputArguments": "", "OutputArguments": "{}", "HostMachineName": "AAAAAAAA11111", "HasMediaRecorded": false, "PersistenceId": null, "ResumeVersion": null, "StopStrategy": null, "RuntimeType": "Development", "RequiresUserInteraction": true, "ReleaseVersionId": 1111, "EntryPointPath": null, "OrganizationUnitId": 1, "OrganizationUnitFullyQualifiedName": "Default", "Reference": "", "ProcessType": "Process", "ProfilingOptions": null, "ResumeOnSameContext": false, "LocalSystemAccount": "AAAAAA01\\AAA11AA", "OrchestratorUserIdentity": null, "Id": 00000 }, { "Key": "aaa1a111-aa11-11aa-a11a-11a1aa11a111", "StartTime": "2023-01-20T14:08:34.607Z", "EndTime": "2023-01-20T14:08:49.517Z", "State": "Successful", "JobPriority": "Normal", "Source": "Agent", "SourceType": "Agent", "BatchExecutionKey": "aaa1a111-aa11-11aa-a11a-11a1aa11a111", "Info": "Job completed", "CreationTime": "2023-01-20T14:08:34.607Z", "StartingScheduleId": null, "ReleaseName": "RobotProdLogin_DEV", "Type": "Attended", "InputArguments": "", "OutputArguments": "{}", "HostMachineName": "AAAAAAAA11111", "HasMediaRecorded": false, "PersistenceId": null, "ResumeVersion": null, "StopStrategy": null, "RuntimeType": "Development", "RequiresUserInteraction": true, "ReleaseVersionId": 1111, "EntryPointPath": null, "OrganizationUnitId": 1, "OrganizationUnitFullyQualifiedName": "Default", "Reference": "", "ProcessType": "Process", "ProfilingOptions": null, "ResumeOnSameContext": false, "LocalSystemAccount": "AAAAAA01\\AAA11AA", "OrchestratorUserIdentity": null, "Id": 00000 },   How i want it to look. Event 1   "@odata.context": "https://example-app-env.aa01.aaa.aaaa-ad/odata/$metadata#Jobs", "@odata.count": 111, "value": [ {   Event 2   { "Key": "aaa1a111-aa11-11aa-a11a-11a1aa11a111", "StartTime": "2023-01-20T14:08:34.607Z", "EndTime": "2023-01-20T14:08:49.517Z", "State": "Successful", "JobPriority": "Normal", "Source": "Agent", "SourceType": "Agent", "BatchExecutionKey": "aaa1a111-aa11-11aa-a11a-11a1aa11a111", "Info": "Job completed", "CreationTime": "2023-01-20T14:08:34.607Z", "StartingScheduleId": null, "ReleaseName": "RobotProdLogin_DEV", "Type": "Attended", "InputArguments": "", "OutputArguments": "{}", "HostMachineName": "AAAAAAAA11111", "HasMediaRecorded": false, "PersistenceId": null, "ResumeVersion": null, "StopStrategy": null, "RuntimeType": "Development", "RequiresUserInteraction": true, "ReleaseVersionId": 1111, "EntryPointPath": null, "OrganizationUnitId": 1, "OrganizationUnitFullyQualifiedName": "Default", "Reference": "", "ProcessType": "Process", "ProfilingOptions": null, "ResumeOnSameContext": false, "LocalSystemAccount": "AAAAAA01\\AAA11AA", "OrchestratorUserIdentity": null, "Id": 00000 },     Can you help? ... View more

Hi there, I have a search where I want to see where one date field is the same or starts before another but my search results only shows me events where both dates are the same, can you help? I am trying to find events which contains an end date that is before the created date. The data isn't create so a typical date entry would be 12112022 index=UAT sourcetype="Test_Txt_data" | eval end_date_epoch = strptime(end_date,"%d%m%Y") | eval created_date_epoch = strptime(created_date,"%d%m%Y") | where end_date_epoch <= created_date_epoch | eval end_date = strftime(end_date_epoch, "%d/%m/%Y"), created_date = strftime(created_date_epoch, "%d/%m/%Y") | table proposal, created_date, end_date ... View more